rudder-tracking-plans — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited rudder-tracking-plans (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill teaches how to assemble events into tracking plans - contracts that define which events a source can send and what properties each event must have.
A tracking plan is a schema that:
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐
│ Source │────▶│ Tracking Plan │────▶│ Destination │
│ (Web App SDK) │ │ (Validator) │ │ (Warehouse) │
└─────────────────┘ └─────────────────┘ └─────────────────┘
│
Validates events
against schemaversion: "rudder/v1"
kind: "tracking-plan"
metadata:
name: "tracking-plans"
spec:
name: "Web App Tracking Plan"
description: "Events for the main e-commerce web application"
events:
- event: "urn:rudder:event/product-viewed"
- event: "urn:rudder:event/product-added-to-cart"
- event: "urn:rudder:event/order-completed"Override event-level rules at the tracking plan level:
version: "rudder/v1"
kind: "tracking-plan"
metadata:
name: "tracking-plans"
spec:
name: "Mobile App Tracking Plan"
description: "Events for iOS and Android apps"
events:
- event: "urn:rudder:event/product-viewed"
rules:
# Make session_id required for mobile (optional in event definition)
- property: "urn:rudder:property/session_id"
required: true
# Make device_id required for mobile attribution
- property: "urn:rudder:property/device_id"
required: true
- event: "urn:rudder:event/product-added-to-cart"
- event: "urn:rudder:event/order-completed"When the same property appears at multiple levels:
1. Tracking Plan event rules (highest priority)
2. Event-level rules (default)
3. Property definitions (validation config only)Example: If session_id is optional in the event definition but required in the tracking plan, it's required for that tracking plan.
See references/ecommerce-example.md for a complete e-commerce example showing:
When events violate the tracking plan:
spec:
name: "Strict Tracking Plan"
governance:
# Options: block, forward, log
unplannedEvents: block # Reject events not in plan
violatingEvents: forward # Forward violations with flag| Setting | Behavior |
|---|---|
block | Reject event entirely |
forward | Forward event with violation metadata |
log | Allow event, log violation for review |
tracking-plans/
├── web-app.yaml
├── mobile-app.yaml
├── kiosk.yaml
└── internal-tools.yamlEach tracking plan in its own file for clear git history and code review.
What application/SDK will use this tracking plan?
Which events from your data catalog does this source need?
Web App needs:
✓ Product Viewed
✓ Product Added to Cart
✓ Order Completed
✗ App Opened (mobile only)For each event, what properties should be:
version: "rudder/v1"
kind: "tracking-plan"
metadata:
name: "tracking-plans"
spec:
name: "Your Tracking Plan Name"
description: "Clear description of what source uses this"
events:
- event: "urn:rudder:event/event-name"
rules:
- property: "urn:rudder:property/property-name"
required: true# Validate
rudder-cli validate -l ./
# Preview
rudder-cli apply --dry-run -l ./
# Apply
rudder-cli apply -l ./After applying, connect the tracking plan to your source:
# tracking-plans/web-app-production.yaml
spec:
name: "Web App - Production"
governance:
unplannedEvents: block # Strict in production
violatingEvents: block
# tracking-plans/web-app-development.yaml
spec:
name: "Web App - Development"
governance:
unplannedEvents: log # Lenient in development
violatingEvents: forwardCreate a comprehensive event catalog, then each tracking plan includes only what it needs:
Data Catalog: 50 events defined
├── Web App Plan: 30 events
├── Mobile Plan: 25 events
└── Kiosk Plan: 5 eventsStart permissive, tighten over time:
# Phase 1: Log only
governance:
unplannedEvents: log
violatingEvents: log
# Phase 2: Forward violations
governance:
unplannedEvents: forward
violatingEvents: forward
# Phase 3: Block violations
governance:
unplannedEvents: block
violatingEvents: block# Validate tracking plan references exist
rudder-cli validate -l ./
# Preview what will change
rudder-cli apply --dry-run -l ./
# Apply to workspace
rudder-cli apply -l ./| Mistake | Problem | Fix |
|---|---|---|
| Event URN not found | Referenced event doesn't exist | Create event in data catalog first |
| Property not in event | Adding property not defined on event | Add property to event rules first |
| Duplicate tracking plan name | Conflict in workspace | Use unique, descriptive names |
| Too strict too fast | Breaking production SDKs | Use log mode first, analyze, then tighten |
After creating and applying a tracking plan:
Events from the source will now be validated against your tracking plan schema.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.